Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

🗓️ 22 Jul 2026 22:56:05Reported by GitHub Advisory DatabaseType

Description FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers)HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests) Location:jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnecti...

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-10051	14 Jul 202608:44	–	attackerkb
Circl	CVE-2026-10051	20 Jul 202605:17	–	circl
CVE	CVE-2026-10051	14 Jul 202608:44	–	cve
Cvelist	CVE-2026-10051	14 Jul 202608:44	–	cvelist
EUVD	EUVD-2026-43645	22 Jul 202622:56	–	euvd
NVD	CVE-2026-10051	14 Jul 202609:16	–	nvd
OSV	CVE-2026-10051	14 Jul 202608:44	–	osv
OSV	GHSA-F4V5-65JJ-PCR2 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections	22 Jul 202622:56	–	osv
OSV	UBUNTU-CVE-2026-10051	14 Jul 202609:16	–	osv
Positive Technologies	PT-2026-57983	14 Jul 202600:00	–	ptsecurity

Vulners

Node

org.eclipse.jetty jetty-serverRange12.1.0–12.1.9maven

org.eclipse.jetty jetty-serverRange12.0.0–12.0.35maven

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-10051
github	www.github.com/jetty/jetty.project/pull/15162
github	www.github.com/jetty/jetty.project/pull/15163
github	www.github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb
github	www.github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9
github	www.github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
github	www.github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
gitlab	www.gitlab.eclipse.org/security/cve-assignment/-/work_items/119
github	www.github.com/advisories/GHSA-f4v5-65jj-pcr2

22 Jul 2026 22:56Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

CVSS 46.9

EPSS0.00253

SSVC

CWE-200